1 / 27

Spectrum based Fraud Detection in Social Networks

Spectrum based Fraud Detection in Social Networks. Xiaowei Ying, Xintao Wu , Daniel Barbara . Random Link Attack Shirvastava et al. icde08 . An abstraction of collaborative attacks including spam, viral marketing, individual re-identification via active/passive attacks

elke
Download Presentation

Spectrum based Fraud Detection in Social Networks

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Spectrum based Fraud Detection in Social Networks Xiaowei Ying, Xintao Wu, Daniel Barbara

  2. Random Link Attack Shirvastava et al. icde08 • An abstraction of collaborative attacks including spam, viral marketing, individual re-identification via active/passive attacks • The attacker creates some fake nodes and uses them to attack a large set of randomly selected regular nodes; • Fake nodes also mimic the real graph structure among themselves to evade detection.

  3. Topology Approach Shirvastava et al. icde08 • Idea • count external triangles around each node --- neighbors of a regular user have many triangles, but random victims do not. • Algorithm • detecting suspects • clustering test and neighborhood independence test • detecting RLAs • GREEDY and TRWALK • Limitation • too many parameters • high computational cost • difficult to detect when there exist multiple RLAs

  4. Our Approach Examine the spectral space of graph topology. • : undirected, un-weighted, unsigned, and without considering link/node attribute information; • Adjacency Matrix A (symmetric) • Adjacency Eigenspace

  5. Adjacency Eigenspace Spectral coordinate: Ying and Wu SDM09 Polbook Network

  6. Spectrum Based Fraud Detection • RLA– from the matrix perturbation point of view

  7. Spectrum Based Fraud Detection • Approximate the spectral coordinate

  8. Approximation • Approximate the eigenvector in random link attack Attacking nodes first order second order Regular nodes

  9. Illustrating network data • Network of the political blogs on the 2004 U.S. election (polblogs, 1,222 nodes and 16,714 edges) • The blogs were labeled as either liberal or conservative.

  10. Illustrating example • Political blogs (1222, 16714): each node labeled as either liberal or conservative • Add one RLA with 20 attacking nodes that have the same degree dist. as the regular ones.

  11. Problem • We do not know who are attackers/victims in the graph topology. • For Random Link Attacks, we can derive the distribution of attacking nodes’ spectral coordinates.

  12. Dist. of attackers’ spectral coordinates • The spectral coordinate of attacking node p has the normal distribution with mean and variance bounded by: We can get the region in the spectral space where RLA attacking nodes appear with high prob. Inner structure of attackers does not affect the region!!! polblogs (1222, 16714), 20 attackers, each randomly attacks 30 victims

  13. Using node non-randomness • It is tedious to check every dimension one by one. • The node non-randomness of RLA attackers We derive the upper bounds of mean and variance and get the decision line:

  14. Identifying suspects • The node non-randomness of RLA attackers Nodes below the decision line are suspects

  15. RLAs with varied inner structure

  16. SPCTRA Algorithm

  17. Evaluation • Topology based RLA detection approach – Shrivastava et al. ICDE08 • clustering test and neighborhood independence test • GREEDY and TRWALK • Experimental Setting • Political blogs (1222,16714), add 1 RLA with 20 attackers • Web Spam Challenge data (114K nodes and 1.8M links), add a mix of 8 RLAs with varied sizes and connection patterns.

  18. Accuracy • Evaluation on Web spam challenge data A snapshot of websites in domain .UK (2007) SPCTRA: based on spectral space GREEDY: based on outer-triangles [Shrivastava, ICDE, 2008]

  19. Execution time • TRWALK is 10 times faster than GREEDY (with less accuracy), but still 100 times slower than SPCTRA. • Discussion of complexity is in the paper.

  20. Bipartite Core Attacks Attacker creates two type of nodes: • Accomplices: behave like normal users except heavily connecting to fraudsters to enhance fraudsters’ rating. • Fraudsters: nodes that actually do frauds, mostly connect to accomplices. • No link exists within accomplices or fraudsters. Figure from: DuenHorngChau et. al., Detecting Fraudulent Personalities in Networks of Online Auctioneers Bipartite core

  21. Bipartite Core Attacks 20 fraudsters and 30 accomplices.

  22. DDoS attacks Attacker controls 10% normal nodes to attack one victim node.

  23. Conclusion • Present a framework that exploits the spectral space of graph topology to detect attacks. • Theoretical analysis showed that attackers locate in a different region from the regular ones in the spectral space. • Develop the SPCTRA algorithm for detecting RLAs. • Demonstrate its effectiveness and efficiency through empirical evaluation.

  24. Future Work • Explore other attacking scenarios in both social networks and communication networks. • In Sybil attacks, attackers may choose victims purposely, rather than randomly. • Track how graph evolves dynamically.

  25. Thank You! Questions? Acknowledgments This work was collaborated with Xiaowei Ying and Daniel Barbara, and was supported in part by U.S. National Science Foundation IIS-0546027 , CNS-0831204 and CCF-1047621.

  26. Another Example

  27. Adjacency Eigenspace Spectral coordinate: Ying and Wu SDM09 Polbook Network

More Related